Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
googlecontainertools/skaffold
main @ f9beeb7
3
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Command Injection: 1 prior fix. Scrutinize any change in this area.
CI/CD: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Direct interpolation of untrusted GitHub context variables into GitHub Actions 'run' blocks allows workflows to execute arbitrary attacker-controlled commands. This can lead to runner compromise and credential theft.
Privilege Escalation: Vulnerabilities in underlying vendor dependencies, such as docker/cli (CVE-2025-15558), can expose the container runner or build host to privilege escalation risks.
Information Disclosure: An overly broad authorization scope during docker push actions can result in leaking registry credentials to unauthorized or external repositories/registries.